{"id":29403515,"url":"https://github.com/webstean/azure-application-landing-zone","last_synced_at":"2026-05-18T15:39:07.726Z","repository":{"id":303944779,"uuid":"1017240254","full_name":"webstean/azure-application-landing-zone","owner":"webstean","description":"Andrew's module for creating an Azure Application Landing Zone","archived":false,"fork":false,"pushed_at":"2025-07-25T07:49:20.000Z","size":274,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-25T12:52:50.861Z","etag":null,"topics":["application-landing-zone","azure","cac","caf","configuration","terraform"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/providers/webstean/application-landing-zone/latest/docs","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/webstean.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-10T08:31:07.000Z","updated_at":"2025-07-25T07:49:24.000Z","dependencies_parsed_at":"2025-07-10T17:02:51.452Z","dependency_job_id":"998b728c-a460-4fed-8364-381e929ec86c","html_url":"https://github.com/webstean/azure-application-landing-zone","commit_stats":null,"previous_names":["webstean/azure-application-landing-zone"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/webstean/azure-application-landing-zone","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fazure-application-landing-zone","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fazure-application-landing-zone/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fazure-application-landing-zone/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fazure-application-landing-zone/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/webstean","download_url":"https://codeload.github.com/webstean/azure-application-landing-zone/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fazure-application-landing-zone/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33183276,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-18T09:27:30.708Z","status":"ssl_error","status_checked_at":"2026-05-18T09:27:28.300Z","response_time":71,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["application-landing-zone","azure","cac","caf","configuration","terraform"],"created_at":"2025-07-10T19:00:30.921Z","updated_at":"2026-05-18T15:39:07.720Z","avatar_url":"https://github.com/webstean.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- BEGIN_TF_DOCS --\u003e\n# Andrew's module for creating an Azure Application Landing Zone\notherwise known as an environment (dev, test, sit, uat etc..)\n\n[GitHub Repository](https://github.com/webstean/azure-application-landing-zone)\n\n[Terraform Registry for this module](https://github.com/webstean/azure-application-landing-zone)\n\n[Terraform Registry Home - my other modules](https://registry.terraform.io/namespaces/webstean)\n\n[![Python][terraform-shield]][tf-version]\n[![Latest][version-shield]][release-url]\n[![Tests][test-shield]][test-url]\n[![License][license-shield]][license-url]\n\u003c!-- [![Contributors][contributors-shield]][contributors-url]\n[![Forks][forks-shield]][forks-url]\n[![Stargazers][stars-shield]][stars-url]\n[![Issues][issues-shield]][issues-url] --\u003e\n\nThis module creates what Microsoft's calls an [Application Landing Zone](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/app-platform/ready) which you can think of an environment in which you applications and services can run, like DEV, TEST, SIT, UAT, PROD, etc.\n\nThis is apart of what Microsoft calls their [Well-Architected Framework](https://learn.microsoft.com/en-us/azure/well-architected/what-is-well-architected-framework).\n\nThis module will deploy many different types of resources including, but not limited to:\n- One Public DNS Zone (unless the variable always\\_create\\_private\\_link is set to \"yes\")\n- One Virtual Network with preconfigure subnets and Bastion, which is used hosting resources in the Landing Zone\n- Lots Private DNS for use with Private LInk (Only when the variable always\\_create\\_private\\_link is set to \"yes\")\n- Two User Assigned Identities, one in intended for humans and the other for services/applications\n- One Static Web App, for hosting static contect, such as information on the created landing zone\n- One Log Analytics Workspace (including a \"web\" Application Insights) for logging, monitoring, alerting and debugging\n- One KeyVault which you should use, you should create your own KeyVault for secrets, such as passwords, certificates, etc.\n- One SQL Server associated with one SQL Server Elastic Pool (these are free, until you put a database in them), configured for SQL Hyperscale\n- One Cosmos DB Account\n- One Azure Communication Service (ACS) for sending emails, SMSes and WhatsApp messages\n- Three Storage Accounts (one for SQL Servers logs, one for files and one for the blobs)\n- An Automation Account for running scripts, such as Azure CLI or PowerShell scripts either manually or via a schedule\n\nand finally:\n- One App Configuration preconfigured with all the landing zone deployments (SQL Server endpoints etc...)\n\nYou need to tell the module which Azure Resource Group to put everything in, as this won't be created by this module, in order to support [Azure Deployment Environments](https://learn.microsoft.com/en-us/azure/deployment-environments/overview-what-is-azure-deployment-environments)\n\nOption, you can peer the Virtual Network into an existing vWAN Hub, which will allow you to connect to other Landing Zones and the Internet in general securelty via centralised infrastrucutre.\nThis infrastructure can be deployed via the\n\n\u003e [!IMPORTANT]\n\u003e ❗ This is important\n\u003e\n\n\u003e [!NOTE]\n\u003e ⚠️ Eventually this module will create an [Azure Network Perimeter](https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-concepts) around everything in the Landing Zone, further isolating it from other Landing Zone and the Internet in general.\n\u003e\n\n\u003e [!CAUTION]\n\u003e ℹ️ This module creates lots of resources, that SHOULD cost zero to very little money, but things change! BE CAREFUL, so you don't get **Bill Shocks**\n\u003e\n\n![Azure Landing Zone](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/enterprise-scale/media/azure-landing-zone-architecture-diagram-hub-spoke.svg#lightbox)\n\nExample:\n```hcl\nmodule \"application-landing-zone\" {\n  source  = \"webstean/azure-application-landing-zone/azurerm\"\n  version = \"~\u003e0.0, \u003c 1.0\"\n\n  ## identity\n  user_assigned_identity_graph_name        = null\n  user_assigned_identity_landing_zone_name = module.application_landing_zone.user_assigned_identity_name  ## (high-privilege) for services/applications\n  entra_group_unified_id                   = null\n  entra_group_pag_id                       = data.azuread_group.cloud_operators.id                        ## (low-privilege)  for humans/admin users\n  ## naming\n  resource_group_name               = data.azurerm_resource_group.lz.name\n  landing_zone_name                 = \"play\"\n  project_name                      = \"main\"\n  application_name                  = \"webstean\"\n  ## sizing\n  sku_name                          = \"free\"          ## other options are: basic, standard, premium or isolated\n  size_name                         = \"small\"         ## other options are: medium, large or x-large\n  location_key                      = \"australiaeast\" ## other supported options are: australiasoutheast, australiacentral\n  private_endpoints_always_deployed = false ## other option is: true\n\n  ## these are just use for the tags to be applied to each resource\n  owner_service        = \"unknown@myorg.com\"          ## business owner  - email address, used for visbility \u0026 alerts\n  owner_tech           = \"unknown@myorg.com\"          ## business owner  - email address, used for visbility \u0026 alerts\n  cost_centre          = \"unknown\"                    ## from the accountants, its the owner's cost centre. Freeform text\n  monitoring           = \"not-monitored\"              ## other options are: 24-7 or 8-5\n  ##\n  subscription_id                   = data.azurerm_client_config.current.subscription_id\n  keyvault_name = module.azure-application-landing-zone-keyvault.key_vault_name\n\n}\n```\n---\n## License\n\nDistributed under the Mozilla Public License Version 2.0 License. See [LICENSE](./LICENSE) for more information.\n\n\u003c!-- markdownlint-disable MD033 --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | ~\u003e1.0, \u003c 2.0 |\n| \u003ca name=\"requirement_acme\"\u003e\u003c/a\u003e [acme](#requirement\\_acme) | ~\u003e2.0, \u003c 3.0 |\n| \u003ca name=\"requirement_alz\"\u003e\u003c/a\u003e [alz](#requirement\\_alz) | ~\u003e0.0, \u003c 1.0 |\n| \u003ca name=\"requirement_azapi\"\u003e\u003c/a\u003e [azapi](#requirement\\_azapi) | ~\u003e 2.0, \u003c 3.0 |\n| \u003ca name=\"requirement_azuread\"\u003e\u003c/a\u003e [azuread](#requirement\\_azuread) | ~\u003e 3.0, \u003c 4.0 |\n| \u003ca name=\"requirement_azurerm\"\u003e\u003c/a\u003e [azurerm](#requirement\\_azurerm) | ~\u003e4.0, \u003c 5.0 |\n| \u003ca name=\"requirement_random\"\u003e\u003c/a\u003e [random](#requirement\\_random) | ~\u003e3.0, \u003c 4.0 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [azapi_update_resource.comms-identity](https://registry.terraform.io/providers/azure/azapi/latest/docs/resources/update_resource) | resource |\n| [azuread_service_principal.existing-apim](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource |\n| [azuread_service_principal.existing-dynamicserp](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource |\n| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource |\n| [azurerm_application_insights.web](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/application_insights) | resource |\n| [azurerm_application_insights_snapshot_debugger.web](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/application_insights_snapshot_debugger) | resource |\n| [azurerm_communication_service.comms](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/communication_service) | resource |\n| [azurerm_communication_service_email_domain_association.comms](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/communication_service_email_domain_association) | resource |\n| [azurerm_email_communication_service.comms](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/email_communication_service) | resource |\n| [azurerm_email_communication_service_domain.comms](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/email_communication_service_domain) | resource |\n| [azurerm_key_vault_key.comms_app_configuration](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key) | resource |\n| [azurerm_key_vault_secret.primary-connection](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |\n| [azurerm_key_vault_secret.primary-key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |\n| [azurerm_key_vault_secret.secondary-connection](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |\n| [azurerm_key_vault_secret.secondary-key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |\n| [azurerm_monitor_diagnostic_setting.bastion1](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) | resource |\n| [azurerm_monitor_diagnostic_setting.bastion2](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) | resource |\n| [azurerm_monitor_diagnostic_setting.bastion_public_ip1](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) | resource |\n| [azurerm_monitor_diagnostic_setting.comms1](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) | resource |\n| [azurerm_monitor_diagnostic_setting.comms2](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) | resource |\n| [azurerm_monitor_workspace.grafana](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_workspace) | resource |\n| [azurerm_nat_gateway.vnet-nat-gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/nat_gateway) | resource |\n| [azurerm_nat_gateway_public_ip_association.vnet-nat-gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/nat_gateway_public_ip_association) | resource |\n| [azurerm_network_security_group.any](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_group.anytcp](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_group.bastion](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_group.dns](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_group.linux](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_group.tls](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_group.unifi](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_group.windows](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_public_ip.vnet-nat-gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) | resource |\n| [azurerm_role_assignment.application_insights_contributor1](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |\n| [azurerm_role_assignment.application_insights_contributor2](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |\n| [azurerm_role_assignment.application_insights_snapshot_debugger](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |\n| [azurerm_role_assignment.grafana_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |\n| [azurerm_role_assignment.grafana_viewer](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |\n| [azurerm_subnet_nat_gateway_association.vnet-nat-gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_nat_gateway_association) | resource |\n| [azurerm_subnet_service_endpoint_storage_policy.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_service_endpoint_storage_policy) | resource |\n| [random_id.ula_global_id](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |\n| [random_string.naming_seed](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |\n| [azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application_published_app_ids) | data source |\n| [azuread_client_config.current](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/client_config) | data source |\n| [azuread_domains.admin](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.default](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.initial](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.root](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.unmanaged](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_service_principal.existing-apim](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source |\n| [azuread_service_principal.existing-dynamicserp](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source |\n| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source |\n| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |\n| [azurerm_management_group.root](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/management_group) | data source |\n| [azurerm_resource_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |\n| [azurerm_role_definition.blob_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.blob_owner](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.blob_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.file_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.owner](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_processor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_sender](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.reader_and_access](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.smb_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.smb_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.storage_defender](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.table_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.table_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_subscription.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |\n| [azurerm_subscriptions.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscriptions) | data source |\n| [http_http.public_ip](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) | data source |\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_dns_zone_name\"\u003e\u003c/a\u003e [dns\\_zone\\_name](#input\\_dns\\_zone\\_name) | This variable provides the name public DNS zones to of an existing controls the whether or not Microsoft telemetry is enabled for the AVM modules, that modeule will call.\u003cbr/\u003eFor more information see https://aka.ms/avm/telemetryinfo.\u003cbr/\u003eIf it is set to false, then no telemetry will be collected.\u003cbr/\u003eThe default is true. | `string` | n/a | yes |\n| \u003ca name=\"input_org_fullname\"\u003e\u003c/a\u003e [org\\_fullname](#input\\_org\\_fullname) | The full name (long form) for your organisation. This is used for more , for use in descriptive and display names.\u003cbr/\u003eThis is intended to be a human readable name, so that it can be used in the Azure | `string` | n/a | yes |\n| \u003ca name=\"input_resource_group_name\"\u003e\u003c/a\u003e [resource\\_group\\_name](#input\\_resource\\_group\\_name) | (Required) The name of the resource group to deploy the resources into. This resource group needs to be already exist! | `string` | n/a | yes |\n| \u003ca name=\"input_subscription_id\"\u003e\u003c/a\u003e [subscription\\_id](#input\\_subscription\\_id) | The Azure Subscription ID for the AzureRM, AzureAD, AzApi providers to use for their deployment.\u003cbr/\u003eThis is the subscription where the resources will be deployed and whoever is running the module (terraform code) must have high-level permission to this subscription.\u003cbr/\u003eTypically this needs to be the following Azure RBAC roles: User Access Administrator and Contributor permissions.\u003cbr/\u003eIf you using GitHub / Azure DevOps (ADO), then you should leverage OIDC to provide federation, instead of having to maintain secrets, which can be compromised. | `string` | n/a | yes |\n| \u003ca name=\"input_bypass_ip_cidr\"\u003e\u003c/a\u003e [bypass\\_ip\\_cidr](#input\\_bypass\\_ip\\_cidr) | (Required) bypass\\_ip\\_cidr (CIDR notation) is a list of IP addresses or CIDR ranges that should be allowed to bypass the firewall for Azure PaaS service like storage accounts, sql servers etc..\u003cbr/\u003e  This is typically used for management purposes, such as allowing access from a specific IP address or range of IP addresses, such as a management workstation or a specific network. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_cost_centre\"\u003e\u003c/a\u003e [cost\\_centre](#input\\_cost\\_centre) | Cost Centre for assigning resource costs, can be be anything number or string or combination (perhaps consider using an email address | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_data_phi\"\u003e\u003c/a\u003e [data\\_phi](#input\\_data\\_phi) | (Required) data\\_phi (true or false) These resources will contain and/or process Personally Health Information (PHI)\u003cbr/\u003eNote, this WILL NOT enable priivate endppoints, since is conntrolled via the var.always\\_enable\\_private\\_endpoints variable.\u003cbr/\u003eHowever, is does enable a lot of security services, that are typcially called \"Defender\" by Microsoft.\u003cbr/\u003eThese services add a lot of values, such as vulnerability scanning, threat detection, security alerts, and more.\u003cbr/\u003eBut, they come at a cost, so you need to be aware of that. | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_data_pii\"\u003e\u003c/a\u003e [data\\_pii](#input\\_data\\_pii) | (Required) data\\_pii (true or false) These resources will contain and/or process Personally Identifiable Information (PII)\u003cbr/\u003eNote, this WILL NOT enable priivate endppoints, since is conntrolled via the var.always\\_enable\\_private\\_endpoints variable.\u003cbr/\u003eHowever, is does enable a lot of security services, that are typcially called \"Defender\" by Microsoft.\u003cbr/\u003eThese services add a lot of values, such as vulnerability scanning, threat detection, security alerts, and more.\u003cbr/\u003eBut, they come at a cost, so you need to be aware of that. | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_enable_telemetry\"\u003e\u003c/a\u003e [enable\\_telemetry](#input\\_enable\\_telemetry) | This variable controls whether or not Microsoft telemetry is enabled for the AVM modules, that modeule will call.\u003cbr/\u003eFor more information see https://aka.ms/avm/telemetryinfo.\u003cbr/\u003eIf it is set to false, then no telemetry will be collected.\u003cbr/\u003eThe default is true. | `bool` | `false` | no |\n| \u003ca name=\"input_landing_zone_name\"\u003e\u003c/a\u003e [landing\\_zone\\_name](#input\\_landing\\_zone\\_name) | (Required) environment\\_name (freeform) must be one of (\"core\", \"platform\", \"play\", \"dev\", \"test\", \"mvp\", \"uat\", \"sit\", \"preprod\", \"prod\", \"production\", \"live\") so we can tell what each resource is being used for\u003cbr/\u003eThis also coressponds to the Application Landing Zone that the resource/resources will be deployed into.\u003cbr/\u003eAn application landing zone consist of a set of secure, compliant and container type resources, intended to support many applications, web sites and databases.\u003cbr/\u003eSome people in our opinion, over use landing zones and create too many of them, which makes it harder to manage.\u003cbr/\u003eWe would suggest, you consider a landing\\_zone as what you might call an environment: DEV, TEST, UAT, PreProd etc...\u003cbr/\u003eThe default is \"test\" | `string` | `\"test\"` | no |\n| \u003ca name=\"input_location_key\"\u003e\u003c/a\u003e [location\\_key](#input\\_location\\_key) | The Azure location where the resource is to be deployed into. This is a key into the local.regions map (see locals.tf), which contains the applicable Azure region information.\u003cbr/\u003eThe local.tf is used to map the location\\_key to the actual Azure region name, so that it can be used in the azurerm/azapi providers.\u003cbr/\u003eUnless you are using Australian regions, then you will need to customise the local.regions map to include your region amd alter the validation statements below, since they initially only support the Australia regions (australieast, australiasoutheast, australiacentral) | `string` | `\"australiaeast\"` | no |\n| \u003ca name=\"input_monitoring\"\u003e\u003c/a\u003e [monitoring](#input\\_monitoring) | Set the resource tags for all the resources, so you know what sort of monitoring the resources will be eligible for.\u003cbr/\u003eYou can even use these tags, to only enrolled resources in certain monitoring solutions and what time alerts should be generated (anytime, office hours only).\u003cbr/\u003eYou'll typically need to be comply with ITIL and other opertional frameworks and potentially enteprise requirements.\u003cbr/\u003elike Azure Monitor, Azure Log Analytics, Azure Application Insights etc...\u003cbr/\u003eThe supported values are\"24-7\", \"8-5\" or \"not-monitored\"\u003cbr/\u003eThe default is \"not-monitored\" which means that the resources will not be enrolled in any monitoring solution. | `string` | `\"not-monitored\"` | no |\n| \u003ca name=\"input_org_shortname\"\u003e\u003c/a\u003e [org\\_shortname](#input\\_org\\_shortname) | The short name (abbreviation) of the entire organisation, use for naming Azure resources.\u003cbr/\u003eAvoid using exotic characters, so that it can be used in all sorts of places, like DNS names, Azure resource names, Azure AD display names etc... | `string` | `\"org\"` | no |\n| \u003ca name=\"input_owner_service\"\u003e\u003c/a\u003e [owner\\_service](#input\\_owner\\_service) | The name (preferably email address) of the service owner for contacting in a disaster or seeking guiandance.\u003cbr/\u003eThis is intended to assist in complying with frameworks like ITIL, COBIT, ISO27001, NIST etc...\u003cbr/\u003eHe basically tell who is responsible for the resource, so that if when these is a problem, we know who to contact.\u003cbr/\u003eThis will appear in the owner tag of the resource, so that it can be easily found. | `string` | `\"unknown@unknown.org\"` | no |\n| \u003ca name=\"input_owner_tech\"\u003e\u003c/a\u003e [owner\\_tech](#input\\_owner\\_tech) | The name (preferably email address) of the technicalwner for contacting in a disaster or seeking guiandance.\u003cbr/\u003eThis is intended to assist in complying with frameworks like ITIL, COBIT, ISO27001, NIST etc...\u003cbr/\u003eHe basically tell who is responsible for the resource, so that if when these is a problem, we know who to contact.\u003cbr/\u003eThis will appear in the owner tag of the resource, so that it can be easily found. | `string` | `\"unknown@unknown.org\"` | no |\n| \u003ca name=\"input_private_endpoints_always_deployed\"\u003e\u003c/a\u003e [private\\_endpoints\\_always\\_deployed](#input\\_private\\_endpoints\\_always\\_deployed) | (Required) private\\_endpoints\\_always\\_deployed (true or false) If private endpoints should be deployed, where available. This requires the sku\\_name to be either \"premium\" or \"isolated\"\u003cbr/\u003eThe use of Private Endpoints is typically a hardcore requirement for hosting real data. Any PEN test will almost always want Private Endpoints everywhere.\u003cbr/\u003eLooking at the Azure Pricing, you might think that Private Endpoints arn't that expensive. But you would be WROMG!\u003cbr/\u003eYou are paying for the private endpoint basically for every second that it exists. It does not take long for these costs to add up.\u003cbr/\u003eUnless you are hosting real data (PII and PHI) then you should not use Private Endpoints, unless you want to waste money, and for really large organisation this might not be a concern.\u003cbr/\u003eWe have as a separate configuration option for private endpoints, because sometimes people want to test private endpoints in DEV scenarios.\u003cbr/\u003eTechnically private endpoint should never be needed, as any Azure endpoint is protected via Entra ID authentcation/authorisation, but this is a single point of failure. If Entra was misconfigured for example, your data would potneitally be exposed.\u003cbr/\u003eHence, Prviate Endpoints are a good idea, by providing a 2nd layer of security (look up the swiss cheese approach to security. But they ultimately NOT CHEAP\u003cbr/\u003eThe default is false And, it can only be set to true, unless the sku\\_name is set to either \"premium\" or \"isolated\".\u003cbr/\u003eThis is because Private Endpoints are typically only available for the higher end skus | `bool` | `false` | no |\n| \u003ca name=\"input_size_name\"\u003e\u003c/a\u003e [size\\_name](#input\\_size\\_name) | (Required) The size\\_name (only specific values) for the size of resources to be deployed.\u003cbr/\u003eThis is an option for some resources, in addition to the SKU and the module makes decisions, which obviously just our opinion.\u003cbr/\u003eFeel free to adjust the module as you see fit, but we are pretty confident our resources are pretty reasonable for most circumstances.\u003cbr/\u003eThe support vaalues are \"small\", \"medium\", \"large\" or \"x-large\"\u003cbr/\u003eNote: The larger the size the higher the cost! These cost differecnes can be very significant, so please be careful.\u003cbr/\u003eCurrently the validation only support the use of the \"small\" SKU, please edit to use the others. | `string` | `\"small\"` | no |\n| \u003ca name=\"input_sku_name\"\u003e\u003c/a\u003e [sku\\_name](#input\\_sku\\_name) | (Required) The sku\\_name (only specific values) of the resource to be created (free, basic, standard, premium or isolated)\u003cbr/\u003eThe higher the sku, the more capabilities such as high availability and auto scalling are available.\u003cbr/\u003eThese modules, determine which sku\\_name corresponds to which actual Azure SKU, that you would like to deploy.\u003cbr/\u003eObviously, this is subject to opinion, so whilst we are configdent our choices work well in most environments, you are free to adjust this module to so that you can use the same sku\\_name across all modules.\u003cbr/\u003eThe higher end skus (premium, isolated) are typically very expensive and totaly overkill for most applications.\u003cbr/\u003eNote: The free sku is only applicable to some resources and in some cases the resources created with the \"free\" sku may not actually be free, but should be very minimal cost.\u003cbr/\u003eThe validation rules, only permit the use of the \"free\" and \"basic\" sku to prevent unintended consequences (ie a huge bill at the end of the month)\u003cbr/\u003eThe module will happily create these higher SKU resource, so simply edit the validation rule (below) to leverage them. | `string` | `\"free\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_cost_centre\"\u003e\u003c/a\u003e [cost\\_centre](#output\\_cost\\_centre) | Cost Centre for assigning resource costs, can be be anything number or string or combination (perhaps consider using an email address |\n| \u003ca name=\"output_data_phi\"\u003e\u003c/a\u003e [data\\_phi](#output\\_data\\_phi) | (Required) These resources will contain and/or process Personally Health Information (PHI) |\n| \u003ca name=\"output_data_pii\"\u003e\u003c/a\u003e [data\\_pii](#output\\_data\\_pii) | (Required) These resources will contain and/or process Personally Identifiable Information (PII) |\n| \u003ca name=\"output_landing_zone_name\"\u003e\u003c/a\u003e [landing\\_zone\\_name](#output\\_landing\\_zone\\_name) | (Required) landing\\_zone\\_name must be one of (\"core\", \"platform\", \"play\", \"dev\", \"test\", \"uat\", \"sit\", \"preprod\", \"prod\", \"live\") so we can tell what each resource is being used for\u003cbr/\u003eThis also coresponds to the Application Landing Zone that the resource/resources will be deployed into. |\n| \u003ca name=\"output_location_key\"\u003e\u003c/a\u003e [location\\_key](#output\\_location\\_key) | The Azure location where the resource is to be deployed into. This is a key into the local.regions map, which contains the applicable Azure region information. |\n| \u003ca name=\"output_monitoring\"\u003e\u003c/a\u003e [monitoring](#output\\_monitoring) | Set the tags, that defines what sort of monitoring the resources will be eligible for |\n| \u003ca name=\"output_owner_service\"\u003e\u003c/a\u003e [owner\\_service](#output\\_owner\\_service) | The name (preferably email address) of the resource owner for contacting in a disaster or seeking guiandance |\n| \u003ca name=\"output_owner_tech\"\u003e\u003c/a\u003e [owner\\_tech](#output\\_owner\\_tech) | The name (preferably email address) of the resource owner for contacting in a disaster or seeking guiandance |\n| \u003ca name=\"output_private_endpoints_always_deployed\"\u003e\u003c/a\u003e [private\\_endpoints\\_always\\_deployed](#output\\_private\\_endpoints\\_always\\_deployed) | (Required) If private endpoints should be deployed, where available. Requires the cost to be set to High |\n| \u003ca name=\"output_region_lake_containers\"\u003e\u003c/a\u003e [region\\_lake\\_containers](#output\\_region\\_lake\\_containers) | n/a |\n| \u003ca name=\"output_size_name\"\u003e\u003c/a\u003e [size\\_name](#output\\_size\\_name) | (Required) The size of the resultant resource/resources (small, medium, large or x-large).\u003cbr/\u003eNote: The larger the size the higher the cost! |\n| \u003ca name=\"output_sku_name\"\u003e\u003c/a\u003e [sku\\_name](#output\\_sku\\_name) | (Required) The sku\\_name of the resource to be created (for example, free, basic, standard, premium or isolated)\u003cbr/\u003eThe higher the sku, the more capabilities such as high availability and auto scalling are available. |\n| \u003ca name=\"output_subscription_display_name\"\u003e\u003c/a\u003e [subscription\\_display\\_name](#output\\_subscription\\_display\\_name) | Azure Subscription Display Name |\n| \u003ca name=\"output_subscription_id\"\u003e\u003c/a\u003e [subscription\\_id](#output\\_subscription\\_id) | Azure Subscription ID |\n| \u003ca name=\"output_tenant_id\"\u003e\u003c/a\u003e [tenant\\_id](#output\\_tenant\\_id) | Azure Tenant ID |\n| \u003ca name=\"output_virtual_network_id\"\u003e\u003c/a\u003e [virtual\\_network\\_id](#output\\_virtual\\_network\\_id) | Map of virtual network IDs with their names |\n| \u003ca name=\"output_virtual_network_subnet_ids\"\u003e\u003c/a\u003e [virtual\\_network\\_subnet\\_ids](#output\\_virtual\\_network\\_subnet\\_ids) | Map of subnet IDs with their types |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_azure_bastion\"\u003e\u003c/a\u003e [azure\\_bastion](#module\\_azure\\_bastion) | Azure/avm-res-network-bastionhost/azurerm | ~\u003e0.0, \u003c 1.0 |\n| \u003ca name=\"module_bastion_public_ip\"\u003e\u003c/a\u003e [bastion\\_public\\_ip](#module\\_bastion\\_public\\_ip) | Azure/avm-res-network-publicipaddress/azurerm | ~\u003e0.0, \u003c 1.0 |\n| \u003ca name=\"module_log_analytics_workspace\"\u003e\u003c/a\u003e [log\\_analytics\\_workspace](#module\\_log\\_analytics\\_workspace) | Azure/avm-res-operationalinsights-workspace/azurerm | ~\u003e0.0, \u003c 1.0 |\n| \u003ca name=\"module_lz-init\"\u003e\u003c/a\u003e [lz-init](#module\\_lz-init) | ./init/ | n/a |\n| \u003ca name=\"module_lz-setup\"\u003e\u003c/a\u003e [lz-setup](#module\\_lz-setup) | ./setup/ | n/a |\n| \u003ca name=\"module_naming-global\"\u003e\u003c/a\u003e [naming-global](#module\\_naming-global) | Azure/naming/azurerm | ~\u003e0.0, \u003c 1.0 |\n| \u003ca name=\"module_naming-landing-zone\"\u003e\u003c/a\u003e [naming-landing-zone](#module\\_naming-landing-zone) | Azure/naming/azurerm | ~\u003e0.0, \u003c 1.0 |\n| \u003ca name=\"module_virutal_network\"\u003e\u003c/a\u003e [virutal\\_network](#module\\_virutal\\_network) | Azure/avm-res-network-virtualnetwork/azurerm | ~\u003e0.0, \u003c 1.0 |\n\n---\n\n## Additional References\n\n\u003cdetails\u003e\n\u003csummary\u003eClick to expand\u003c/summary\u003e\n\n- [Terraform Download](https://www.terraform.io/downloads.html)\n- [Visual Code Download](https://code.visualstudio.com/Download)\n- [Powershell VS Code Extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.PowerShell)\n- [HashiCorp Terraform VS Code Extension](https://marketplace.visualstudio.com/items?itemName=HashiCorp.terraform)\n- [Azure Terraform VS Code Extension Name](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azureterraform)\n- [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-windows?tabs=azure-cli)\n- [Configure the Azure Terraform Visual Studio Code extension](https://docs.microsoft.com/en-us/azure/developer/terraform/configure-vs-code-extension-for-terraform)\n- [Setup video](https://youtu.be/YmbmpGdhI6w)\n\n\u003c/details\u003e\n\nGenerated with [terraform-docs](https://terraform-docs.io/)\n\u003c!-- END_TF_DOCS --\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwebstean%2Fazure-application-landing-zone","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwebstean%2Fazure-application-landing-zone","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwebstean%2Fazure-application-landing-zone/lists"}